authorize via cookie as well as basic auth

this is required for websockets auth